[Pkg-utopia-maintainers] Bug#1152782: cockpit-machines: CVE-2026-113495

[Salvatore Bonaccorso]

Source: cockpit-machines
Version: 359-1
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for cockpit-machines.

CVE-2026-113495[0]:
| A flaw was found in cockpit-machines. Red Hat Subscription
| Management (RHSM) authentication tokens are passed as command-line
| arguments to background helper processes during image retrieval
| operations. A local, unprivileged attacker on a system permitting
| cross-user process inspection can view these arguments while the
| process is active. This flaw can lead to information disclosure,
| potentially allowing unauthorized access to RHSM resources within
| the token's validity period.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-113495
    https://www.cve.org/CVERecord?id=CVE-2026-113495
[1] https://github.com/advisories/GHSA-rq8f-q9xv-wmhm
[2] https://github.com/cockpit-project/cockpit-machines/commit/b058e6872778d1ae362634b44463adf387ba49ea

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore